ClawHub
Back to skill

Security audit

npm

Security checks for vulnerabilities and agentic risk

Overview

This is a focused npm release helper with no hidden code, but users should avoid pasting one-time passwords into command-line examples.

Use this only for intentional npm release work. Prefer npm's interactive OTP prompt or trusted publishing instead of inserting an OTP into a command, and confirm the package directory, version, and tag before running any publish or dist-tag command.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:61
Finding

npm One-Time Password Exposed Through Command-Line Arguments

Content
View full analysis
" ``` ```bash npm publish --access public --tag beta --otp="" ``` ### Technical Analysis The documented publishing workflow instructs users or agents to substitute an npm one-time password directly into the `--otp` command-line argument. Although obtaining an OTP is legitimate for an authenticated npm publication, placing the value in a command exposes it to local observation channels such as: - Shell history files - Terminal or tmux logging - Command auditing and session-recording systems - Debug output or shell tracing - Process inspection while the command is running - Agent execution transcripts The related instruction at `SKILL.md:47` limits OTP retrieval to situations where npm requires it and therefore does not, by itself, exceed the publishing task's necessary privileges. No instruction sends the OTP to an unrelated service. The weakness is the insecure transfer of that credential from the password manager into a visible command-line argument. ### Attack Path 1. A release operator or agent initiates an npm publication that requires an OTP. 2. The OTP is retrieved through the referenced 1Password workflow. 3. The operator or agent replaces `` with the actual value in one of the documented commands. 4. The resulting command is captured through shell history, tmux logging, process monitoring, execution transcripts, or terminal-session recording. 5. An attacker with access to that local observation channel extracts the OTP before it expires. 6. If the attacker also has a usable npm authentication session or token, they may reuse the OTP to authorize a malicious publication or another protected npm operation during the OTP's validity window. ### Impact Assessment Succe ...[truncated 651 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep